Impossibility of Order-Revealing Encryption in Idealized Models.
Mark Zhandry, Cong Zhang · IACR Cryptology ePrint Archive · 2017
An Order-Revealing Encryption (ORE) scheme gives a public procedure by which two ciphertexts can be compared to reveal the order of their underlying plaintexts. The ideal security notion for ORE is that only the order is revealed—anything else, such as the distance between plaintexts, is hidden. The only known constructions of ORE achieving such ideal security are based on cryptographic multilinear maps and are currently too impractical for real-world applications.